A proof of concept for delivering an API credential through Declarative Device Management and letting a signed broker use it, so MDM scripts can trigger an authenticated request without ever holding the secret. Includes the signing, install-behavior, and asset-hosting problems that cost me most of two days.
How a single committed secret inspired a complete rethinking of Jamf Pro script management, and the open-source framework that came out of it. Presented at JNUC 2026, Kansas City, MO.
How I forked App Auto-Patch to fix users being re-prompted for weeks: an accumulating discovery cache that locks on install day, a cadence gate, a cache-only Self Service workflow, and a pile of lessons about 1Password’s background processes.
How a one-off cleanup of Jamf Pro mobile app records turned into a preview-first audit and remediation tool, and then into a native macOS app so nobody has to touch a CSV or a terminal.
A one-day security review changed this self-service admin tool from a timer and user-writable state into a root-owned record with multiple revocation backstops.
A Self Service tool that shows users their pinned packages, IT policy, available updates and known vulnerabilities for Homebrew, then lets them update on their own. Most of the design came down to deciding which data to trust locally and which to ask the Workbrew API for.
Two small Python tools that feed Snipe-IT from both ends of a Mac’s life: abm2snipe creates pre-deployment assets from Apple Business Manager orders, and jamf2snipe keeps enrolled devices current. Notes on pagination bugs, a BYOD filter that silently didn’t work, and signing an ES256 client assertion for Apple’s newer API.
What I put in a half-day workshop on versioned, secret-scanned, linted macOS script repos: Gitleaks, ShellCheck, semantic versioning, CI, and what to do when a secret is already in your history.
Security Called: How I Turned a Scripting Disaster into a GitOps Pipeline, presented at the Mac Admins Conference at Penn State.
A 3.5-hour hands-on build-along workshop on macOS GitOps with Shikomi, presented at the Mac Admins Conference at Penn State.